rundll32.exe Executes DLL from WebDAV-Mounted Network Path

Ibrahim Saud@tektrix

•updated 19 days ago•0•0•2

Detects instances where rundll32.exe is used to execute a DLL file directly from a remote WebDAV-mounted network path (indicated by the 'DavWWWRoot' string). This technique allows for the execution of arbitrary code without writing the malicious payload to the local disk, a common tactic seen in fileless malware delivery and campaigns like ClearFake.